CNE GCP Ready: Managing Secrets and Licenses

Liferay Cloud Native Experience (CNE) retrieves sensitive values from an external secrets provider. This approach prevents credentials, certificates, and licenses from being stored in GitOps repositories.

The External Secrets Operator (ESO) synchronizes secrets from your configured vault into Kubernetes, where CNE consumes them during deployment.

Configure the Secrets Vault

Google Secret Manager (Default)

Google Secret Manager is the default secrets provider for CNE GCP Ready.

The bootstrap process configures Workload Identity so Kubernetes workloads can retrieve secrets securely without storing static credentials in the cluster.

The default IAM policy grants access to these secret prefixes:

liferay-certificates-
liferay-licenses-
liferay-credentials-gitops

These prefixes allow GCP Ready to retrieve TLS certificates, licenses, and GitOps credentials during deployment.

Configure a Custom Secrets Provider

You can configure a different secrets provider, such as:

HashiCorp Vault
AWS Secrets Manager
Azure Key Vault

To use a custom provider,

Create a service account with permission to read secrets from the provider.

Define the external_secret_store_provider_hcl variable in your Terraform configuration.

Example HashiCorp Vault configuration:

external_secret_store_provider_hcl = {
   vault = {
      auth = {
         tokenSecretRef = {
            key  = "token"
            name = "vault-token"
         }
      }
      path    = "secret"
      server  = "http://my.vault.server:8200"
      version = "v2"
   }
}

See the External Secrets Operator for additional provider configuration options.

Configure GitOps Repository Credentials

GCP Ready requires credentials to access the GitOps repository that stores deployment configuration.

Store these credentials in Google Secret Manager as a JSON payload.

Default secret name:

liferay-credentials-gitops

To use a different secret name, update the credentials_secret_name value in config.json.

Example:

{
   "variables": {
      "liferay_git_repo_config": {
         "auth": {
            "credentials_secret_name": "company/credentials/gitops"
         }
      }
   }
}

The authentication method is configured through infrastructure_git_repo_config.auth.method.

Supported values:

https
github_app
ssh

Personal Access Token (HTTPS)

Create a secret containing these JSON fields:

Key	Description
`git_machine_user_id`	Git username or machine account name
`git_access_token`	Personal Access Token (PAT)

Example payload:

{
   "git_machine_user_id": "user",
   "git_access_token": "ghp_abc...WxYZ"
}

Create the secret:

gcloud secrets create "liferay-credentials-gitops" \
   --replication-policy="automatic" \
   --data-file="gitops-pat.json"

GitHub App Authentication

GitHub App authentication provides short-lived credentials scoped to the repository installation.

Before creating the secret,

Create a GitHub App in your organization or user account.
Grant the app read access to the GitOps repository contents.
Install the app on the GitOps repository.
Note the App ID and Installation ID.
Generate and download the private key (.pem) for the app.

Create a secret containing these JSON fields:

Key	Description
`github_app_id`	GitHub App ID
`github_app_installation_id`	GitHub App installation ID
`github_app_private_key`	GitHub App private key

Example payload:

{
   "github_app_id": "123456",
   "github_app_installation_id": "78901234",
   "github_app_private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
}

Note

Preserve newline characters in the private key when storing the JSON payload.

Create the secret:

gcloud secrets create "liferay-credentials-gitops" \
   --replication-policy="automatic" \
   --data-file="gitops-github-app.json"

Configure the authentication method in your GitOps Terraform configuration (gitops/resources/terraform.tfvars):

infrastructure_git_repo_config = {
   auth = {
      method = "github_app"
   }
}

If your Liferay GitOps repository also uses GitHub App authentication, configure the same value for liferay_git_repo_config.auth.method.

SSH Authentication

Create a secret containing this JSON field:

Key	Description
`git_ssh_private_key`	SSH private key

Example payload:

{
   "git_ssh_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
}

Configure the authentication method in gitops/resources/terraform.tfvars:

infrastructure_git_repo_config = {
   auth = {
      method = "ssh"
   }
}

If you use a custom secret name instead of liferay-credentials-gitops, update the credentials_secret_name value in config.json:

{
   "liferay_git_repo_config": {
      "auth": {
         "credentials_secret_name": "custom-gitops-secret"
      }
   }
}

Configure TLS Certificates

Store TLS certificates in Google Secret Manager using the liferay-certificates- prefix.

Each certificate secret must contain these JSON fields:

Key	Description
`tls.crt`	TLS certificate
`tls.key`	TLS private key

Example payload:

{
   "tls.crt": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
   "tls.key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
}

Create the secret:

gcloud secrets create "liferay-certificates-mydomain" \
   --replication-policy="automatic" \
   --data-file="cert-payload.json"

The External Secrets Operator synchronizes this secret into Kubernetes as a TLS secret.

Configure Liferay Licenses

Note

Ensure you have your Liferay .xml activation key. See Activating Liferay DXP to learn more.

Store Liferay licenses in Google Secret Manager using the liferay-licenses- prefix.

Each license secret must contain this JSON field:

Key	Description
`license.xml`	Liferay license XML

Example payload:

{
   "license.xml": "<?xml version=\"1.0\"?>\n<license>...</license>"
}

Create the secret:

gcloud secrets create "liferay-licenses-mylicense" \
   --replication-policy="automatic" \
   --data-file="license-payload.json"

Mount the License in Liferay

After storing the license, configure CNE to retrieve and mount it in the Liferay deployment.

Configure the External Secret Reference

Add the license reference to infrastructure.yaml:

license:
  externalSecretName: "liferay-licenses-mylicense"
  targetSecretName: "liferay-license"

externalSecretName identifies the secret in Google Secret Manager.
targetSecretName defines the Kubernetes Secret created in the cluster.

Configure Liferay to Consume the License

Update liferay.yaml:

customEnv:
  x-license:
    - name: LIFERAY_DISABLE_TRIAL_LICENSE
      value: "true"

customVolumeMounts:
  x-license:
    - mountPath: /etc/liferay/mount/files/deploy/license.xml
      name: liferay-license
      subPath: license.xml

customVolumes:
  x-license:
    - name: liferay-license
      secret:
        secretName: liferay-license

The subPath mount places the license at /etc/liferay/mount/files/deploy/license.xml without overwriting other files in the hot-deploy directory.

Note

The secretName value under customVolumes must match the targetSecretName defined in infrastructure.yaml.

After committing these changes, the External Secrets Operator synchronizes the license from Google Secret Manager and mounts it in the Liferay container during deployment.

Capability: